announce@apache.org, 2026-09

You are viewing a plain text version of this content. The canonical link for it is here.

- [ANNOUNCE] Apache NetBeans 31 Released - posted by Eric Barboni <sk...@apache.org> on 2026/09/01 08:13:58 UTC, 0 replies.
- CVE-2026-32773: Apache Spark: XSS Vulnerability in Spark Web 3.5.4 - posted by Holden Karau <ho...@apache.org> on 2026/09/01 20:57:04 UTC, 0 replies.
- Apache Beam 2.76.0 Released! - posted by Vitalii Terentev <vt...@apache.org> on 2026/09/02 13:57:33 UTC, 0 replies.
- [ANNOUNCE] Apache CloudStack Regular Release 4.23.0.0 - posted by Wei Zhou <we...@apache.org> on 2026/09/02 15:19:36 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ v6.3.2 has been released! - posted by Matt Pavlovich <ma...@apache.org> on 2026/09/02 15:33:09 UTC, 0 replies.
- [ANNOUNCE] Apache Allura 1.21.0 released - posted by Dave Brondsema <br...@apache.org> on 2026/09/03 17:26:43 UTC, 0 replies.
- CVE-2026-80180: Apache Allura: Stored XSS via markdown HTML processing - posted by Dave Brondsema <br...@apache.org> on 2026/09/03 17:33:52 UTC, 0 replies.
- CVE-2026-80181: Apache Allura: Server-side request forgery - posted by Dave Brondsema <br...@apache.org> on 2026/09/03 17:34:46 UTC, 0 replies.
- CVE-2026-80190: Apache Allura: Stored XSS via code repositories - posted by Dave Brondsema <br...@apache.org> on 2026/09/03 17:35:38 UTC, 0 replies.
- CVE-2026-81270: Apache Allura: Information exposure via search - posted by Dave Brondsema <br...@apache.org> on 2026/09/03 17:36:36 UTC, 0 replies.
- Re: [ANNOUNCE] Apache Shiro 3.0.1 released - posted by Lenny Primak <lp...@apache.org> on 2026/09/03 18:53:45 UTC, 0 replies.
- CVE-2026-71216: Apache SkyWalking: PagerDuty alarm hook transmits the integration routing key over cleartext HTTP - posted by Kai Wan <wa...@apache.org> on 2026/09/04 00:02:48 UTC, 0 replies.
- CVE-2026-85229: Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057) - posted by Sheng Wu <wu...@apache.org> on 2026/09/04 00:05:42 UTC, 0 replies.
- [ANNOUNCE] Release Apache OpenDAL 0.59.0 - posted by Xuanwo <xu...@apache.org> on 2026/09/04 04:45:42 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.7.1 released - posted by Shawn Yang <ch...@apache.org> on 2026/09/04 07:10:14 UTC, 0 replies.
- CVE-2026-52691: Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module - posted by Arnout Engelen <en...@apache.org> on 2026/09/04 12:56:31 UTC, 0 replies.
- [ANNOUNCE] Apache Commons Secure XML 1.0.0 - posted by Gary Gregory <gg...@apache.org> on 2026/09/06 15:59:13 UTC, 0 replies.
- [ANN] Apache Ant 1.10.18 Released - posted by Stefan Bodewig <bo...@apache.org> on 2026/09/06 18:03:50 UTC, 0 replies.
- CVE-2026-78254: Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write - posted by Stefan Bodewig <bo...@apache.org> on 2026/09/06 18:07:29 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 5.1.2 Released - posted by Paul King <pa...@apache.org> on 2026/09/07 06:53:54 UTC, 0 replies.
- [ANNOUNCE] Apache PLC4X 1.0.0 released - posted by Christofer Dutz <cd...@apache.org> on 2026/09/07 08:34:13 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0-RC-1 Released - posted by Paul King <pa...@apache.org> on 2026/09/07 12:31:01 UTC, 0 replies.
- [ANN] Apache Tomcat Native 2.0.16 released - posted by Mark Thomas <ma...@apache.org> on 2026/09/07 20:57:56 UTC, 0 replies.
- [ANN] Apache Tomcat Native 1.3.9 released - posted by Mark Thomas <ma...@apache.org> on 2026/09/07 20:57:58 UTC, 0 replies.
- CVE-2026-84939: Apache FreeMarker: A malformed locale may be exploitable for path traversal attacks - posted by Dániel Dékány <dd...@apache.org> on 2026/09/08 10:02:04 UTC, 0 replies.
- [ANNOUNCE] Apache Nutch 1.23 Release - posted by Sebastian Nagel <sn...@apache.org> on 2026/09/08 10:20:35 UTC, 0 replies.
- CVE-2026-41869: Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API) - posted by Sebastian Nagel <sn...@apache.org> on 2026/09/08 10:36:38 UTC, 0 replies.
- CVE-2026-41870: Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API) - posted by Sebastian Nagel <sn...@apache.org> on 2026/09/08 10:37:24 UTC, 0 replies.
- CVE-2026-41871: Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API) - posted by Sebastian Nagel <sn...@apache.org> on 2026/09/08 10:37:49 UTC, 0 replies.
- CVE-2026-74761: Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId - posted by Matt Pavlovich <ma...@apache.org> on 2026/09/08 14:26:48 UTC, 0 replies.
- CVE-2026-75156: Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass - posted by Niko Oliveira <on...@apache.org> on 2026/09/08 16:32:21 UTC, 0 replies.
- [ANNOUNCE] Apache Arrow Go v18.8.0 Released - posted by Matt Topol <ze...@apache.org> on 2026/09/08 19:26:36 UTC, 0 replies.
- [ANNOUNCE] Apache Impala 4.5.2 release - posted by Michael Smith <mi...@apache.org> on 2026/09/08 19:59:42 UTC, 0 replies.
- CVE-2026-54048: Apache Impala: Avro Schema URL Server-Side Request Forgery - posted by Michael Smith <mi...@apache.org> on 2026/09/08 20:45:15 UTC, 0 replies.
- CVE-2026-56207: Apache Impala: SAML authentication bypass via forged bearer token - posted by Michael Smith <mi...@apache.org> on 2026/09/08 20:49:03 UTC, 0 replies.
- CVE-2026-57866: Apache Impala: Secrets Exfiltration via SSRF - posted by Michael Smith <mi...@apache.org> on 2026/09/08 20:54:58 UTC, 0 replies.
- CVE-2026-65181: Apache Impala: RCE via External Data Source Class Loading - posted by Michael Smith <mi...@apache.org> on 2026/09/08 20:57:37 UTC, 0 replies.
- [ANNOUNCE] Release Apache DolphinScheduler 3.4.3 - posted by wenjun <we...@apache.org> on 2026/09/09 01:52:38 UTC, 0 replies.
- CVE-2026-49362: Apache Artemis, Apache ActiveMQ Artemis: Missing Authentication in CORE Protocol Handler Allows Unauthorized Queue Creation - posted by Clebert Suconic <cl...@apache.org> on 2026/09/09 20:22:07 UTC, 0 replies.
- CVE-2026-49363: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Information Disclosure in CORE Protocol Topology Subscription - posted by Clebert Suconic <cl...@apache.org> on 2026/09/09 20:23:33 UTC, 0 replies.
- CVE-2026-49364: Apache Artemis, Apache ActiveMQ Artemis: Pre-Authentication Cluster Credential Exposure to Discovered Peers - posted by Clebert Suconic <cl...@apache.org> on 2026/09/09 20:24:17 UTC, 0 replies.
- CVE-2026-57822: Apache Artemis, Apache ActiveMQ Artemis: Message-based management parameter deserialization may lead to denial of service - posted by Clebert Suconic <cl...@apache.org> on 2026/09/09 20:25:17 UTC, 0 replies.
- CVE-2026-57967: Apache Artemis, Apache ActiveMQ Artemis: Missing authentication on CORE protocol session reattachment - posted by Clebert Suconic <cl...@apache.org> on 2026/09/09 20:25:55 UTC, 0 replies.
- CVE-2026-67593: Apache Artemis, Apache ActiveMQ Artemis: Pre-authentication Openwire protocol handling can result in queue deletion - posted by Clebert Suconic <cl...@apache.org> on 2026/09/09 20:26:32 UTC, 0 replies.
- CVE-2026-75880: Apache Artemis, Apache ActiveMQ Artemis: Message selector wildcard handling could lead to denial of service - posted by Clebert Suconic <cl...@apache.org> on 2026/09/09 20:27:11 UTC, 0 replies.
- [ANNOUNCE] Apache Commons BCEL Version 6.13.0 - posted by Gary Gregory <gg...@apache.org> on 2026/09/10 06:21:01 UTC, 0 replies.
- CVE-2026-80351: Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod - posted by Pasquale Congiusti <pc...@apache.org> on 2026/09/10 06:42:13 UTC, 0 replies.
- CVE-2026-80352: Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects - posted by Pasquale Congiusti <pc...@apache.org> on 2026/09/10 06:42:27 UTC, 0 replies.
- CVE-2026-80354: Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace - posted by Pasquale Congiusti <pc...@apache.org> on 2026/09/10 06:42:40 UTC, 0 replies.
- [ANNOUNCE] Apache James MIME4J 0.8.14 released - posted by "Benoit TELLIER (Apache)" <bt...@apache.org> on 2026/09/10 12:58:57 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.7.2 released - posted by Shawn Yang <ch...@apache.org> on 2026/09/11 09:40:36 UTC, 0 replies.
- CVE-2026-67211: Apache OpenNLP: OOM DoS via Unbounded Array Allocation in SymSpellModelSerializer - posted by Richard Zowalla <rz...@apache.org> on 2026/09/11 17:38:50 UTC, 0 replies.
- CVE-2026-82617: Apache OpenNLP: ReDoS / stack exhaustion in RegexNameFinderFactory built-in EMAIL and URL patterns - posted by Richard Zowalla <rz...@apache.org> on 2026/09/11 17:39:13 UTC, 0 replies.
- [ANNOUNCE] OpenNLP 2.5.12 and 3.0.0-M6 released - posted by Richard Zowalla <rz...@apache.org> on 2026/09/11 17:42:00 UTC, 0 replies.
- [ANNOUNCE] Apache Storm 3.1.0 released - posted by Rui Abreu <ra...@apache.org> on 2026/09/12 22:54:49 UTC, 0 replies.
- CVE-2026-82426: Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:45:23 UTC, 0 replies.
- CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:45:37 UTC, 0 replies.
- CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:45:45 UTC, 0 replies.
- CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:45:55 UTC, 0 replies.
- CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:02 UTC, 0 replies.
- CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:10 UTC, 0 replies.
- CVE-2026-82432: Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:16 UTC, 0 replies.
- CVE-2026-82433: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:22 UTC, 0 replies.
- CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:46:30 UTC, 0 replies.
- CVE-2026-82435: Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:47:02 UTC, 0 replies.
- CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:48:00 UTC, 0 replies.
- CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:48:07 UTC, 0 replies.
- CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:48:14 UTC, 0 replies.
- CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:48:42 UTC, 0 replies.
- CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page - posted by Richard Zowalla <rz...@apache.org> on 2026/09/13 05:49:05 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0-RC-2 Released - posted by Paul King <pa...@apache.org> on 2026/09/13 12:30:55 UTC, 0 replies.
- [ANNOUNCE] Apache IoTDB 2.0.11 released - posted by Haonan Hou <ha...@apache.org> on 2026/09/14 07:25:46 UTC, 0 replies.
- [ANNOUNCE] Apache Camel Karaf 4.18.4 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/14 07:32:12 UTC, 0 replies.
- [ANN] Apache Syncope 4.1.3 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:12:46 UTC, 0 replies.
- [ANN] Apache Syncope 4.0.8 - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:14:19 UTC, 0 replies.
- CVE-2026-73191: Apache Syncope: CAS service URL injection via Forwarded HTTP headers - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:15:40 UTC, 0 replies.
- CVE-2026-73195: Apache Syncope: CSV export spreadsheet formula injection - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:17:26 UTC, 0 replies.
- CVE-2026-73236: Apache Syncope: Cross-Realm authorization bypass in delegated administration - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:18:24 UTC, 0 replies.
- CVE-2026-73370: Apache Syncope: Cross-Realm boundaries reconciliation bypass - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:19:36 UTC, 0 replies.
- CVE-2026-73178: Apache Syncope: JWT Access Token takeover - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:21:44 UTC, 0 replies.
- CVE-2026-73470: Apache Syncope: Delegating users can grant unowned Roles - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:24:01 UTC, 0 replies.
- CVE-2026-73579: Apache Syncope: Non-recursive Any search could skip Realms restrictions - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:24:47 UTC, 0 replies.
- CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:26:47 UTC, 0 replies.
- CVE-2026-75015: Apache Syncope: Nested secrets leak cleartext into audit records readable - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:27:52 UTC, 0 replies.
- CVE-2026-75030: Apache Syncope: Incomplete authorization checks for Group members deprovisioning - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:28:39 UTC, 0 replies.
- CVE-2026-77051: Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:29:30 UTC, 0 replies.
- CVE-2026-77147: Apache Syncope: Groovy Sandbox escape for empty CommandArgs - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:30:24 UTC, 0 replies.
- CVE-2026-77181: Apache Syncope: ClientApp update entitlement not effective - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:38:47 UTC, 0 replies.
- CVE-2026-77883: Apache Syncope: Information disclosure via one-hop JEXL navigation past the JexlContextBuilder name denylist - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:41:05 UTC, 0 replies.
- CVE-2026-78318: Apache Syncope: Unauthenticated reflected XSS in Console and Enduser - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:42:00 UTC, 0 replies.
- CVE-2026-78330: Apache Syncope: Privilege escalation for admin user via JWT authentication - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:43:01 UTC, 0 replies.
- CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:44:22 UTC, 0 replies.
- CVE-2026-82232: Apache Syncope: SQL injection via sort parameter in Task search - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:45:57 UTC, 0 replies.
- CVE-2026-86460: Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:46:32 UTC, 0 replies.
- CVE-2026-87779: Apache Syncope: AES Secret Key disclosure via log output - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:47:17 UTC, 0 replies.
- CVE-2026-87785: Apache Syncope: JWT subject spoofing - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:47:50 UTC, 0 replies.
- CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass - posted by Francesco Chicchiriccò <il...@apache.org> on 2026/09/14 08:49:11 UTC, 0 replies.
- CVE-2026-68570: Apache Doris: Authorization bypass leading to unauthorized data access - posted by Calvin Kirs <ki...@apache.org> on 2026/09/14 09:18:17 UTC, 0 replies.
- CVE-2026-72524: Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables - posted by Calvin Kirs <ki...@apache.org> on 2026/09/14 09:21:49 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-09-09 are released - posted by Vincent Beck <vi...@apache.org> on 2026/09/14 16:17:32 UTC, 0 replies.
- [ANNOUNCE] OpenDAL 0.59.2-rc.2 released - posted by xu...@apache.org on 2026/09/15 07:41:24 UTC, 0 replies.
- [ANN] Apache Tomcat 10.1.60 Available - posted by Christopher Schultz <sc...@apache.org> on 2026/09/15 11:24:25 UTC, 0 replies.
- [ANN] Apache Tomcat 11.0.26 Available - posted by Mark Thomas <ma...@apache.org> on 2026/09/15 15:09:30 UTC, 0 replies.
- CVE-2026-84501: Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider - posted by Andor Molnar <an...@apache.org> on 2026/09/15 17:22:09 UTC, 0 replies.
- CVE-2026-84439: Apache ZooKeeper: Audit log injection via unsanitized output from multiple sources - posted by Andor Molnar <an...@apache.org> on 2026/09/15 17:22:17 UTC, 0 replies.
- CVE-2026-79993: Apache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode - posted by Andor Molnar <an...@apache.org> on 2026/09/15 17:22:25 UTC, 0 replies.
- CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode - posted by Andor Molnar <an...@apache.org> on 2026/09/15 17:22:32 UTC, 0 replies.
- CVE-2026-59739: Apache ZooKeeper: Information disclosure via SetWatches reconnect replay - posted by Andor Molnar <an...@apache.org> on 2026/09/15 17:22:39 UTC, 0 replies.
- CVE-2026-86466: Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:23:24 UTC, 0 replies.
- CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:25:10 UTC, 0 replies.
- CVE-2026-76186: Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:26:40 UTC, 0 replies.
- CVE-2026-82310: Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:27:24 UTC, 0 replies.
- CVE-2026-86792: Apache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configuration - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:28:19 UTC, 0 replies.
- CVE-2026-86462: Apache Airflow FAB provider: FAB Admin password PATCH does not invalidate database-backed sessions - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:29:07 UTC, 0 replies.
- CVE-2026-82311: Apache Airflow FAB provider: FAB password reset never invalidates sessions: string/int _user_id comparison is always false - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:30:28 UTC, 0 replies.
- CVE-2026-86465: Apache Airflow Akeyless provider: Akeyless secrets backend: team-scope guard bypass via user-controlled key - posted by Vincent Beck <vi...@apache.org> on 2026/09/15 18:31:07 UTC, 0 replies.
- [ANN] Apache Tomcat 9.0.122 available - posted by Rémy Maucherat <re...@apache.org> on 2026/09/15 20:22:09 UTC, 0 replies.
- [ANNOUNCE] Apache BookKeeper 4.18.1 released - posted by Matteo Merli <mm...@apache.org> on 2026/09/16 00:13:38 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.7.3 released - posted by Shawn Yang <ch...@apache.org> on 2026/09/16 02:48:03 UTC, 0 replies.
- CVE-2026-70469: Apache NiFi: Improper Handling of Case Sensitivity for Content-Encoding in HTTP Requests - posted by David Handermann <ex...@apache.org> on 2026/09/16 13:58:54 UTC, 0 replies.
- CVE-2026-81866: Apache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration - posted by David Handermann <ex...@apache.org> on 2026/09/16 14:00:51 UTC, 0 replies.
- CVE-2026-82561: Apache NiFi: Missing Authorization for Components Referenced in Flow Update Methods - posted by David Handermann <ex...@apache.org> on 2026/09/16 14:07:31 UTC, 0 replies.
- CVE-2026-86089: Apache NiFi: Missing Process Group Authorization for Connector Migration - posted by David Handermann <ex...@apache.org> on 2026/09/16 14:11:23 UTC, 0 replies.
- CVE-2026-87976: Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles - posted by David Handermann <ex...@apache.org> on 2026/09/16 14:16:18 UTC, 0 replies.
- CVE-2026-76646: Apache MyFaces: Denial of Service via Unbounded Request Parsing - posted by Volodymyr Siedlecki <vo...@apache.org> on 2026/09/16 15:23:07 UTC, 0 replies.
- CVE-2026-68536: Apache MyFaces: Server-Side Request Forgery / Local File Inclusion Vulnerability - posted by Volodymyr Siedlecki <vo...@apache.org> on 2026/09/16 15:24:23 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 5.0.0-M2 released - posted by Lari Hotari <lh...@apache.org> on 2026/09/17 00:27:52 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow 3.3.2 Released - posted by Rahul Vats <ra...@apache.org> on 2026/09/17 10:24:31 UTC, 0 replies.
- [ANNOUNCE] Apache Camel 4.22.1 (LTS) Released - posted by Gregor Zurowski <gz...@apache.org> on 2026/09/17 10:33:18 UTC, 0 replies.
- https://karaf.apache.org/security/cve-2026-92230.txt: CVE-2026-92230: Apache Karaf: Improper release of ClassLoader references via static ThreadLocal caching - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/17 15:09:49 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0-RC-3 Released - posted by Paul King <pa...@apache.org> on 2026/09/17 22:47:37 UTC, 0 replies.
- CVE-2026-75157: Apache Airflow: Asset queued-events DELETE endpoints gated on Dag READ instead of Dag EDIT (asset-triggered scheduling suppression) - posted by Rahul Vats <ra...@apache.org> on 2026/09/18 04:45:03 UTC, 0 replies.
- CVE-2026-91863: Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:28:04 UTC, 0 replies.
- CVE-2026-91864: Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:29:51 UTC, 0 replies.
- CVE-2026-91865: Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:30:31 UTC, 0 replies.
- CVE-2026-91866: Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:30:57 UTC, 0 replies.
- CVE-2026-91867: Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/18 15:31:27 UTC, 0 replies.
- [ANNOUNCE] Apache Calcite Avatica 1.29.0 Released - posted by Francis Chuang <fr...@apache.org> on 2026/09/20 09:45:24 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.7.4 released - posted by Shawn Yang <ch...@apache.org> on 2026/09/20 14:58:19 UTC, 0 replies.
- CVE-2026-47321: Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate - posted by Emmanuel Lécharny <el...@apache.org> on 2026/09/21 07:40:33 UTC, 0 replies.
- CVE-2026-94301: Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232 - posted by Emmanuel Lécharny <el...@apache.org> on 2026/09/21 12:47:17 UTC, 0 replies.
- CVE-2026-82355: Apache Airflow: Session cookie silently overrides explicit Authorization bearer header, enabling session fixation - posted by Rahul Vats <ra...@apache.org> on 2026/09/21 13:22:25 UTC, 0 replies.
- CVE-2026-86473: Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry - posted by Rahul Vats <ra...@apache.org> on 2026/09/21 13:23:02 UTC, 0 replies.
- CVE-2026-75158: Apache Airflow: Assets events API returns asset events for every Dag with no per-Dag authorization filter - posted by Rahul Vats <ra...@apache.org> on 2026/09/21 13:24:09 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 5.1.3 Released - posted by Paul King <pa...@apache.org> on 2026/09/22 05:09:52 UTC, 0 replies.
- [ANNOUNCE] OpenDAL 0.59.3-rc.1 released - posted by xu...@apache.org on 2026/09/22 05:29:58 UTC, 0 replies.
- CVE-2026-70410: Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins - posted by Stamatis Zampetakis <za...@apache.org> on 2026/09/22 13:44:46 UTC, 0 replies.
- CVE-2026-82331: Apache BuildStream: tar source extraction escape - posted by Jürg Billeter <ju...@apache.org> on 2026/09/23 06:03:20 UTC, 0 replies.
- CVE-2026-94243: Apache Sling Security Bundle: RefererFilter accepts weaker-than-origin evidence - posted by Joerg Hoh <jo...@apache.org> on 2026/09/23 08:22:59 UTC, 0 replies.
- CVE-2026-94251: Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource - posted by Joerg Hoh <jo...@apache.org> on 2026/09/23 08:23:21 UTC, 0 replies.
- CVE-2026-91852: Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl - posted by Joerg Hoh <jo...@apache.org> on 2026/09/23 08:24:43 UTC, 0 replies.
- CVE-2026-91928: Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms - posted by Joerg Hoh <jo...@apache.org> on 2026/09/23 08:25:00 UTC, 0 replies.
- CVE-2026-91999: Apache Sling XSS: Improper escaping in the XSS Webconsole plugin - posted by Joerg Hoh <jo...@apache.org> on 2026/09/23 08:25:17 UTC, 0 replies.
- CVE-2026-92001: Apache Sling XSS: Missing parser resource limits - posted by Joerg Hoh <jo...@apache.org> on 2026/09/23 08:25:29 UTC, 0 replies.
- CVE-2026-73192: Apache Sling XSS: XSS possible through XSSAPI.getValidHref() - posted by Joerg Hoh <jo...@apache.org> on 2026/09/23 08:25:55 UTC, 0 replies.
- CVE-2026-31377: Apache Doris: Improper Authentication Allows Unauthorized Access to FE Meta Service - posted by Calvin Kirs <ki...@apache.org> on 2026/09/23 08:43:48 UTC, 0 replies.
- CVE-2026-96443: Apache Doris: JDBC driver URL validation bypass leads to remote code execution - posted by Calvin Kirs <ki...@apache.org> on 2026/09/23 09:28:42 UTC, 0 replies.
- [SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:22 UTC, 0 replies.
- [SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:28 UTC, 0 replies.
- [SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:33 UTC, 0 replies.
- [SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:38 UTC, 0 replies.
- [SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:42 UTC, 0 replies.
- [SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:46 UTC, 0 replies.
- [SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:51 UTC, 0 replies.
- [SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:55 UTC, 0 replies.
- [SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:01:58 UTC, 0 replies.
- [SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:02:03 UTC, 0 replies.
- [SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:02:07 UTC, 0 replies.
- [SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 10:02:12 UTC, 0 replies.
- [SECURITY] CVE-2026-86243 Apache Tomcat Native - DoS via TLS handshake - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 12:21:04 UTC, 0 replies.
- [SECURITY] CVE-2026-86246 Apache Tomcat Native - Insecure OpenSSL options enabled - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 12:21:10 UTC, 0 replies.
- [SECURITY] CVE-2026-86247 Apache Tomcat Native - Client certificate requirements can be down-graded - posted by Mark Thomas <ma...@apache.org> on 2026/09/23 12:21:16 UTC, 0 replies.
- [Missed Voice-Mail] Listen to missed call - Wednesday, 23 September 2026 - posted by an...@apache.org on 2026/09/23 18:34:19 UTC, 0 replies.
- [ANNOUNCE] Apache XMLBeans 5.4.1 release - posted by PJ Fanning <fa...@apache.org> on 2026/09/23 19:21:09 UTC, 0 replies.
- CVE-2026-57590: Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations - posted by Wenjun Ruan <we...@apache.org> on 2026/09/24 08:55:47 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Core 5.4.4 GA released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/09/24 12:07:07 UTC, 0 replies.
- [ANNOUNCEMENT] HttpComponents Core 5.5-beta3 released - posted by Oleg Kalnichevski <ol...@apache.org> on 2026/09/24 12:12:35 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.0.17 - posted by Mattias Reichel <ma...@apache.org> on 2026/09/24 20:34:53 UTC, 0 replies.
- CVE-2026-97636: Apache Airflow HashiCorp provider: HashiCorp Vault secrets backend: team-scope guard bypass via user-controlled key - posted by Jarek Potiuk <po...@apache.org> on 2026/09/24 20:58:58 UTC, 0 replies.
- CVE-2026-92550: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-8/0-9/0-9-1 decoder - posted by Daniil Kirilyuk <da...@apache.org> on 2026/09/24 22:17:05 UTC, 0 replies.
- CVE-2026-92560: Apache Qpid Broker-J: Type size/count handling can lead to excessive allocation pre-authentication in the AMQP 0-10 decoder - posted by Daniil Kirilyuk <da...@apache.org> on 2026/09/24 22:19:23 UTC, 0 replies.
- CVE-2026-92564: Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing - posted by Daniil Kirilyuk <da...@apache.org> on 2026/09/24 22:21:07 UTC, 0 replies.
- CVE-2026-92573: Apache Qpid Broker-J: Uncontrolled resource consumption during AMQP delivery decompression, message conversion and HTTP management JSON rendering - posted by Daniil Kirilyuk <da...@apache.org> on 2026/09/24 22:22:29 UTC, 0 replies.
- CVE-2026-92608: Apache Qpid Broker-J: Incomplete property conversion handling from AMQP 1.0 to AMQP 0-10 - posted by Daniil Kirilyuk <da...@apache.org> on 2026/09/24 22:24:29 UTC, 0 replies.
- CVE-2026-92609: Apache Qpid Broker-J: Missing HTTP-session renewal after successful authentication - posted by Daniil Kirilyuk <da...@apache.org> on 2026/09/24 22:25:29 UTC, 0 replies.
- [ANN] Apache Maven 4.0.0-rc-7 Release - posted by Guillaume Nodet <gn...@apache.org> on 2026/09/24 23:05:04 UTC, 0 replies.
- [ANNOUNCE] Apache Groovy 6.0.0 Released - posted by Paul King <pa...@apache.org> on 2026/09/25 05:19:17 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.1.7 - posted by Mattias Reichel <ma...@apache.org> on 2026/09/25 05:31:12 UTC, 0 replies.
- [ANNOUNCE] Apache Grails 7.2.4 - posted by Mattias Reichel <ma...@apache.org> on 2026/09/25 07:15:49 UTC, 0 replies.
- [ANN] Apache CycloneDX Antlib 0.2 Released - posted by Stefan Bodewig <bo...@apache.org> on 2026/09/25 17:45:14 UTC, 0 replies.
- CVE-2026-82379: Apache Roller: WSSE digest authentication headers can be replayed - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:29 UTC, 0 replies.
- CVE-2026-82380: Apache Roller: CSRF protection bypass via self-generated salt validation - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:35 UTC, 0 replies.
- CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:40 UTC, 0 replies.
- CVE-2026-82382: Apache Roller: Reflected cross-site scripting in the frontpage directory parameter - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:52 UTC, 0 replies.
- CVE-2026-82383: Apache Roller: Anonymous setup action allows frontpage configuration tampering - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:11:57 UTC, 0 replies.
- CVE-2026-82384: Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:02 UTC, 0 replies.
- CVE-2026-82375: Apache Roller: Server-side request forgery via entry trackback and enclosure URLs - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:25 UTC, 0 replies.
- CVE-2026-82376: Apache Roller: XML external entity processing in trackback response parser - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:30 UTC, 0 replies.
- CVE-2026-82377: Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:36 UTC, 0 replies.
- CVE-2026-82378: Apache Roller: OAuth authorization endpoint trusts request-supplied identity - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:12:42 UTC, 0 replies.
- CVE-2026-82385: Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:13:00 UTC, 0 replies.
- CVE-2026-82386: Apache Roller: XML external entity processing in OPML bookmark import - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:13:09 UTC, 0 replies.
- CVE-2026-82348: Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:37 UTC, 0 replies.
- CVE-2026-82387: Apache Roller: Stored cross-site scripting via uploaded media content type - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:41 UTC, 0 replies.
- CVE-2026-82546: Apache Roller: Stored cross-site scripting through incoming Trackback links - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:46 UTC, 0 replies.
- CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:50 UTC, 0 replies.
- CVE-2026-91204: Apache Roller: Stored javascript: URI in HTML comments - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:16:55 UTC, 0 replies.
- CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator - posted by "David M. Johnson" <sn...@apache.org> on 2026/09/25 20:17:00 UTC, 0 replies.
- [ANNOUNCE] Apache ActiveMQ 6.2.10 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/26 04:22:06 UTC, 0 replies.
- [ANNOUNCE] Apache Karaf 4.4.12 has been released! - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/28 06:00:35 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-73581 Apache Tomcat - OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:35:06 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-75973 Apache Tomcat - Cross-context authentication mix-up with Jakarta Authentication configured - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:41:41 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-76183 Apache Tomcat - Bypass of security constraints for WebSocket endpoints - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:41:54 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-77756 Apache Tomcat - Transfer-Encoding honored for HTTP/1.0 requests - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:03 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-77762 Apache Tomcat - Stale HPACK emitter injects trailers into recycled pooled Request - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:10 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-77791 Apache Tomcat - DoS via busy wait during WebSocket close - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:17 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-78383 Apache Tomcat - AJP DoS via missing request body - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:24 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-78437 Apache Tomcat - HTTP/2 DoS via malformed request - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:33 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-79677 Apache Tomcat - WebSocket DoS due to lost asynchronous write timeout - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:42 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-86248 Apache Tomcat - Fix for CVE-2026-34500 was incomplete. OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:49 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-86350 Apache Tomcat - Regression in fix for CVE-2026-41293 can trigger request header mix-up - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:42:56 UTC, 0 replies.
- [UPDATE][SECURITY] CVE-2026-87022 Apache Tomcat - WebSocket message smuggling with per-message-deflate - posted by Mark Thomas <ma...@apache.org> on 2026/09/28 08:43:04 UTC, 0 replies.
- https://karaf.apache.org/security/cve-2026-90979.txt: CVE-2026-90979: Apache Karaf: LDAP filter injection in JAAS LDAP login modules - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/28 09:03:25 UTC, 0 replies.
- [ANNOUNCE] Apache Polaris 1.8.0 - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/28 09:48:46 UTC, 1 replies.
- https://karaf.apache.org/security/cve-2026-91006.txt: CVE-2026-91006: Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean) - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/28 09:56:28 UTC, 0 replies.
- CVE-2026-85499: Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy - posted by Hongtao Gao <ha...@apache.org> on 2026/09/28 12:37:16 UTC, 0 replies.
- CVE-2026-91012: Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/28 15:31:48 UTC, 0 replies.
- CVE-2026-91048: Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/28 15:52:22 UTC, 0 replies.
- https://karaf.apache.org/security/cve-2026-91085.txt: CVE-2026-91085: Apache Karaf: config:install missing ACL entry allows privilege escalation to admin - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/28 16:08:52 UTC, 0 replies.
- https://karaf.apache.org/security/cve-2026-92142.txt: CVE-2026-92142: Apache Karaf: Authorization bypass in JMX MBean lifecycle operations - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/28 16:17:45 UTC, 0 replies.
- [ANNOUNCE] Apache MINA SSHD 2.20.0 released - posted by Thomas Wolf <tw...@apache.org> on 2026/09/28 18:15:48 UTC, 0 replies.
- [ANNOUNCE] Apache MINA SSHD 3.0.0-M6 released - posted by Thomas Wolf <tw...@apache.org> on 2026/09/28 18:18:22 UTC, 0 replies.
- [ANNOUNCE] Apache Accumulo 4.0.0-alpha-1 - posted by Dave Marion <dl...@apache.org> on 2026/09/28 20:01:01 UTC, 0 replies.
- [ANNOUNCE] Apache LDAP API 2.1.9 released - posted by Emmanuel Lecharny <el...@apache.org> on 2026/09/29 08:04:30 UTC, 0 replies.
- [ANNOUNCE] Apache Airflow Providers prepared on 2026-09-22 are released - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:06:28 UTC, 0 replies.
- CVE-2026-81862: Apache Airflow Teradata provider: Teradata transfer operators embed cloud storage credentials in SQL text, task logs and Teradata query logs - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:48:46 UTC, 0 replies.
- CVE-2026-81914: Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:49:33 UTC, 0 replies.
- CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:51:05 UTC, 0 replies.
- CVE-2026-86843: Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag - posted by Shahar Epstein <sh...@apache.org> on 2026/09/29 08:51:32 UTC, 0 replies.
- CVE-2026-102495: Apache XMLSchema: Denial of service through unbounded recursion when resolving schema imports and includes - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/29 11:02:58 UTC, 0 replies.
- CVE-2026-102496: Apache XMLSchema: Denial of service through deeply nested schema structures - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/29 11:03:17 UTC, 0 replies.
- CVE-2026-102497: Apache XMLSchema: Denial of service through cyclic schema definitions in the schema walker - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/29 11:03:26 UTC, 0 replies.
- CVE-2026-66083: Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource - posted by Wenjun Ruan <we...@apache.org> on 2026/09/29 11:25:42 UTC, 0 replies.
- CVE-2026-71897: Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints - posted by Wenjun Ruan <we...@apache.org> on 2026/09/29 11:26:45 UTC, 0 replies.
- CVE-2026-71898: Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions - posted by Wenjun Ruan <we...@apache.org> on 2026/09/29 11:27:01 UTC, 0 replies.
- CVE-2026-71899: Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure - posted by Wenjun Ruan <we...@apache.org> on 2026/09/29 11:27:16 UTC, 0 replies.
- CVE-2026-78214: Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths - posted by Wenjun Ruan <we...@apache.org> on 2026/09/29 11:27:35 UTC, 0 replies.
- CVE-2026-81569: Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution - posted by Wenjun Ruan <we...@apache.org> on 2026/09/29 11:27:51 UTC, 0 replies.
- CVE-2026-82804: Apache DolphinScheduler: Command Injection in the Alert Script Plugin - posted by Wenjun Ruan <we...@apache.org> on 2026/09/29 11:28:07 UTC, 0 replies.
- CVE-2026-97395: Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials - posted by Jean-Baptiste Onofré <jb...@apache.org> on 2026/09/29 13:44:05 UTC, 0 replies.
- CVE-2026-77185: Apache MINA SSHD: Asynchronous authentication can bypass signature verification - posted by Thomas Wolf <tw...@apache.org> on 2026/09/29 18:06:15 UTC, 0 replies.
- CVE-2026-93994: Apache MINA SSHD: Repeated-publickey policy bypass on server - posted by Thomas Wolf <tw...@apache.org> on 2026/09/29 18:06:55 UTC, 0 replies.
- CVE-2026-93995: Apache MINA SSHD: Remote execution of JGit "archive -o=file.zip" can write file on the server - posted by Thomas Wolf <tw...@apache.org> on 2026/09/29 18:07:39 UTC, 0 replies.
- CVE-2026-93996: Apache MINA SSHD: Memory exhaustion DoS via unbounded SCP command line read - posted by Thomas Wolf <tw...@apache.org> on 2026/09/29 18:08:03 UTC, 0 replies.
- CVE-2026-94002: Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies - posted by Thomas Wolf <tw...@apache.org> on 2026/09/29 18:08:36 UTC, 0 replies.
- CVE-2026-94029: Apache MINA SSHD: Memory exhaustion in SFTP v6 check-file-name/check-file-handle extension - posted by Thomas Wolf <tw...@apache.org> on 2026/09/29 18:08:57 UTC, 0 replies.
- CVE-2026-94052: Apache MINA SSHD: LDAP password authentication ineffective - posted by Thomas Wolf <tw...@apache.org> on 2026/09/29 18:09:24 UTC, 0 replies.
- CVE-2026-94053: Apache MINA SSHD: LDAP injection in sshd-ldap - posted by Thomas Wolf <tw...@apache.org> on 2026/09/29 18:09:48 UTC, 0 replies.
- [ANNOUCE] Apache Commons Lang 3.21.0 - posted by Gary Gregory <gg...@apache.org> on 2026/09/29 20:32:11 UTC, 0 replies.
- [ANNOUNCE] Apache Tika 4.1.0 released - posted by Tim Allison <ta...@apache.org> on 2026/09/29 21:56:38 UTC, 0 replies.
- [ANNOUNCE] Asyncband (Incubating) 0.7.3 released - posted by or...@apache.org on 2026/09/30 02:10:10 UTC, 0 replies.
- [ANNOUNCE] Apache Fory 1.7.6 released - posted by Shawn Yang <ch...@apache.org> on 2026/09/30 03:00:40 UTC, 0 replies.
- CVE-2026-102508: Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade - posted by Christofer Dutz <cd...@apache.org> on 2026/09/30 07:36:58 UTC, 0 replies.
- CVE-2026-102509: Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser - posted by Christofer Dutz <cd...@apache.org> on 2026/09/30 07:37:12 UTC, 0 replies.
- CVE-2026-102510: Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths - posted by Christofer Dutz <cd...@apache.org> on 2026/09/30 07:37:22 UTC, 0 replies.
- CVE-2026-102511: Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them - posted by Christofer Dutz <cd...@apache.org> on 2026/09/30 07:37:33 UTC, 0 replies.
- CVE-2026-85532: Apache WSS4J: Insufficient Validation of Derived-Key Parameters - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:28:17 UTC, 0 replies.
- CVE-2026-87830: Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks. - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:29:52 UTC, 0 replies.
- CVE-2026-88920: Apache WSS4J: SAML Sender-Vouches Authentication Bypass - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:31:52 UTC, 0 replies.
- CVE-2026-89238: Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:34:05 UTC, 0 replies.
- CVE-2026-92121: Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:36:24 UTC, 0 replies.
- CVE-2026-92899: Apache WSS4J: UsernameToken replay protection bypassed by re-encoding the Nonce - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:37:31 UTC, 0 replies.
- CVE-2026-95616: Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions - posted by Colm O hEigeartaigh <co...@apache.org> on 2026/09/30 10:38:57 UTC, 0 replies.